Mainnet v1: the plan and who does what

Decided by Eric, 2026-09-30: mainnet v1 launches without private (shielded) transfers. The shielded pool stays off at genesis and is turned on later at a scheduled height, after an external audit of its circuit. This is what lets mainnet come before the audit money does: the unaudited circuit is the reason mainnet is blocked (docs/mainnet-readiness.md), and a feature that is switched off cannot mint anything.

Launch gates

Mainnet genesis happens only when every gate below links evidence.

#	Gate	Status (2026-09-30)
1	Replay protection: a transaction’s signature commits to its chain, so a testnet transfer cannot be replayed on mainnet (BACKLOG P1)	done in code: ADR-036, PR #43
2	Shielded pool off at mainnet genesis, and the mainnet guards relaxed only for that configuration (ADR needed)	done in code: ADR-037 (PR pending); testnet unaffected
3	7 days on the testnet without a halt (maya-testnet-1 halted once, at 12,530; fixed by ADR-035 and restarted 2026-09-29). Re-genesised 2026-10-04 02:37 for ADR-036, then halted 2 h 45 min (12:59:29 → 15:44:28 KST, blocks 33,506 → 33,507) when Windows Update restarted the validator’s PC for an Insider build — not a consensus fault, but a halt. The clock restarted at 15:44	met 2026-10-28 on the pre-mining build: maya-testnet-1 passed 7 days at streak_seconds 604,832, height 365,994 (reports/sessions/2026-10-28-soak-complete.md), and was stopped on purpose at 661,357 s (7 d 15 h 42 min), height 393,812, halts [], uptime 1.0 (reports/sessions/2026-10-28-testnet-stopped.md). One Oracle VM validator held 71% of stake, so the four PC validators were never needed for quorum. Eric, 2026-10-28: no second public soak (“we validate for 7 days and we continue, no repeat”); the frozen mining build is proven on local multi-validator networks (attacknet, rejoin drills, Hub mining E2E), and the next public genesis is mainnet
4	At least 4 validators on separate machines, run by separate people, joined through staking registration	restated 2026-10-12 by ADR-047 (Eric, “PC launch”, 2026-10-11): four project-run validators on one PC, stated publicly, with the host hardened (infra/foundation-pc/harden-host.ps1). Met when the ADR’s four checks have output in reports/. Separate machines and separate people come after launch
5	Genesis ceremony with several participants (bins/genesis-ceremony), rehearsed on a testnet first	rehearsed 2026-10-10 (procedure only, one machine; docs/runbooks/genesis-ceremony.md): genesis reproduced byte-identical by an independent assembly. The launch found and fixed a p2p bug: validators started together could stay unconnected. Open: the real ceremony with the foundation operators (gate 4), and isolating launch-timestamp behaviour
6	Economics: emission stays nil, or a reward schedule, decided	changed 2026-10-25: Eric chose ADR-044 block rewards (no premine, no treasury, GPU mining) over the fees-only default of 2026-10-04. The lane is built (state/mining_exec.rs, mining_rewards_tests, cargo xtask mining-localnet) but the live testnet genesis carries no bft.mining, so it has never soaked there. The 10-28 re-genesis must carry it, and ADR-044 requires gate 3 to restart on the build that does. Parameters are still defaults until Eric freezes them
8	A validator rejoins after a restart. Found in the 2026-10-04 four-validator dry run: a validator down longer than GC_DEPTH (50 rounds, about half a minute) never catches up, so one reboot costs the network its fault tolerance and a second halts it (ADR-027 “no trustless historical sync”). Serving old certificates from disk over gossip was tried and measured not to work, and snapshot bootstrap lands outside the window too; fix: quorum-attested checkpoints a node imports up to (ADR-038, proposed)	done: < 8 epochs down via checkpoints (ADR-038); any longer via a peer’s snapshot (ADR-043: validators snapshot by default, repeatable --catch-up-from). Evidence: attacknet attack 7 PASS (reports/attacknet/2026-10-10-6.md, back from 9 epochs down), and the live seed re-bootstrapped after 13 epochs (reports/sessions/2026-10-10-recovery.md)
9	Consensus logs stay bounded. Logs were never pruned (maya-testnet-1: 3.1 GB of logs against 162 MB of state in 4.5 days). Old epochs are now removed at each epoch switch; a chain without staking stays in epoch 0, so mainnet runs staking, or logs are compacted within an epoch	met by measurement 2026-10-10: maya-testnet-1 validators keep two epoch directories, 286 MB of bft/ each (was 3.1 GB on 2026-10-04); mainnet runs staking (ADR-040), so epochs switch. Within-epoch compaction not needed; an unsafe attempt was rejected (DECISIONS 2026-10-10)
10	No cheap committee capture, and a way back from a halt. Capture: done in code: stake-weighted committees and checkpoints at mainnet genesis (ADR-040, tested against the attack). Recovery from a halt of more than a third of the stake: open	recovery evidenced: a halt of more than a third ends when those validators restart (attacknet crash f+1: resumed in 8.7 s, reports/attacknet/2026-10-10-6.md; maya-testnet-1 recovered from two whole-set reboots on 2026-10-09). A validator that lost its data comes back from a peer’s snapshot (ADR-043). Open: none in code. More than a third of stake lost for good is not recoverable by any BFT protocol, and needs a social decision (runbook docs/runbooks/chain-halt.md)
7	CI green, the security reviews of gates 1 and 2 clean, and the release built from a tag	open

Three lanes, three sessions

One git worktree per session. Stay inside your lane’s paths, and message the owner before editing theirs. Take turns on heavy builds (Tauri and release builds): this machine runs out of memory with two at once.

Lane A: protocol and launch (session maya2c-c4)

Paths: crates/node (consensus, genesis, transactions), crates/vm, crates/api-gateway, crates/spec-ref, spec/, infra/oracle-free, apps/wallet-gui/core, .github/workflows/release-binaries.yml, and the live testnet in D:\Maya2C-testnet (tunnel and DNS included).

1. Gate 1: chain-bound transaction signatures for every suite (hybrid, suite-tagged, multisig), with spec, vectors, ADR and security review.
2. Gate 2: mainnet with the shielded pool off; the guards allow a value-bearing chain id only in that configuration; ADR.
3. Gate 5: a ceremony runbook, and a dry run on a throwaway testnet.
4. Gate 3: keep the testnet up. Monitoring, alerts, encrypted off-machine backups of the validator key, and moving the seed to Oracle Free once Eric has an account.
5. Releases: tag node-v0.1.0-testnet.1 when #31 and #32 are merged.

Lane B: chat, explorer, website (session maya2c-b7)

Paths: apps/chat*, apps/explorer, apps/faucet, docs/site (home, visuals, components).

1. Explorer live at explorer.maya2c.dev (Lane A adds the tunnel ingress).
2. Maya Chat: a first-run experience that is exciting, not merely functional.
3. The site: a live network-status band (height, blocks per minute, faucet status) from the public API.

Lane C: Maya Wallet redesign (the new session)

Paths: apps/wallet-gui/ui (Leptos UI and styles) and apps/wallet-gui/src-tauri (commands, config). Not apps/wallet-gui/core: signing and fee logic are consensus-adjacent, so ask Lane A before changing them.

The feedback to fix: “the GUI is boring.” What “done” looks like:

• A home screen that feels alive: a large balance with the live testnet height, recent activity, and clear Send and Receive actions.
• Receive with a QR code of the payment URI and one-tap copy.
• Onboarding that explains, in plain words, what the 24 words are and why they matter, with the backup confirmation kept.
• Motion and polish: transitions, loading states, a success moment after a send. Visibly a testnet (badge and colour), so nobody mistakes it for mainnet.
• The site’s design tokens (docs/site/src/styles/maya.css), so wallet, chat, explorer and site look like one product. Coordinate with Lane B.
• Every existing flow still works: apps/wallet-gui/e2e must pass, and the wallet must still send on maya-testnet-1 (fees are priced by the node and paid to the verified collector).

Eric

• Recruit three validator operators (gate 4): people with a machine that stays on. The installer is infra/testnet-vm/install.sh.
• The economics decision (gate 6).
• An Oracle Cloud account, so the seed leaves this PC.
• Tell the investor what they will see: the dates come from the gates above, not from a promise.